linux-rng/kernel/trace/trace_probe.c, branch linus/master

Merge tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

2026-08-20T22:11:52Z

Pull probes updates from Masami Hiramatsu: "BTF typecasting and variable fetch enhancements: - Typecast support across probe events: Extended BTF typecasting syntax (e.g., (STRUCT)PARAM->MEMBER) to kprobes, uprobes, and fprobes on function entry and return - Nested typecasts: Added support for chaining and nesting typecasts up to 3 levels, including casting registers and stack variables - Field specifier option: Added (STRUCT,FIELD) syntax to emulate container_of(), allowing retrieval of parent structures from member pointers - $current variable support: Introduced $current special variable to access the running task_struct via BTF dereferencing - Per-CPU variable access: Added this_cpu_read() and this_cpu_ptr() fetcharg methods to trace CPU-local data safely - Fetcharg bytecode dumper: Added CONFIG_PROBE_EVENTS_DUMP_FETCHARG to dump the compiled fetcharg bytecode instructions as comments in dynamic_events - Extended symbol name handling: Removed the MAX_COMMON_HEAD_LEN limit and extended MAX_ARGSTR_LEN to 256 bytes, enabling probing of long symbols, mangled Rust symbols and complex BTF expressions - eprobe variable syntax: Allowed eprobes to reference event fields directly without requiring a '$' prefix - Cleanup unused parameters, redundant codes, duplicate macros and pointer arithmetic - Use a ternary operator for simplifying fetch_type_from_btf_type() Expanded boot time dynamic probe support: - Add boot-time tracing configuration support for event probes (eprobes), function probes (fprobes), and tracepoint probes (tprobes) - Allow comment lines ('#') in dynamic_events file Optimization, robustness, and cleanups: - Simplify fprobe_remove_ips() by reusing graph and ftrace helpers - Remove __packed attribute from struct __fprobe_header to avoid unaligned memory access penalties on RISC architectures - Remove redundant memset() calls in perf event probe handlers - Replace legacy __ASSEMBLY__ with __ASSEMBLER__ in header files Selftests & refactoring: - Refactor parse_probe_arg() and parse_probe_vars(), and eliminate recursion in probe argument parsing to protect kernel stack depth - Add selftests for BTF typecasts and module probing without module prefixes - Force LC_ALL=C in ftracetest to prevent test failures on localized systems - Refactor btf_type_skip_modifiers() to remove ignored id parameter - Sort ERRORS list in trace_probe.h alphabetically - Fix typo in fprobe docs, and trace_fprobe function name - Rename FETCH_OP_DATA to FETCH_OP_IMMSTR - Make file offset error message probe-agnostic" * tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (37 commits) fprobe: Simplify fprobe_remove_ips() by reusing existing helpers tracing/boot: Add support for eprobe, fprobe, and tprobe events selftests/ftrace: Force C locale in ftracetest tracing/probes: Treating longer symbol name on event comparation docs: trace: fprobe: fix 'thos' spelling tracing/probes: Fix extra whitespace in trace_probe_kernel.h tracing/kprobe: Remove redundant memset in kprobe_perf_func() tracing/fprobe: Remove redundant memset in fentry_perf_func() tracing/fprobe: Remove redundant snprintf in trace_fprobe_match_command_head() tracing/probes: Simplify BTF_KIND_PTR case in fetch_type_from_btf_type() tracing/probes: Cleanup pointer arithmetic in store_trace_entry_data() tracing/probes: Remove unused parameter from parse_probe_var_retval() tracing/probes: Remove redundant bounds check in trace_probe_compare_arg_type() tracing/probes: Remove redundant boolean conversion in trace_probe_has_single_file() tracing/probes: Remove duplicate MAX_ARRAY_LEN macro definition selftests/ftrace: Add test case for a symbol in a module without module name tracing/probes: Eliminate recursion in parse_probe_arg() tracing/probes: Extend max length of argument string tracing/probes: Sort ERRORS list in trace_probe.h alphabetically tracing/probes: Refactor parse_probe_arg() ...

tracing/probes: Reject $arg0 in meta argument expansion

2026-07-28T14:58:31Z

traceprobe_expand_meta_args() parses $argN with simple_strtoul() and calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is -1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in sprint_nth_btf_arg() does not catch the negative index, and ctx->params[-1].name_off is read out of bounds. The normal per-argument path (parse_probe_vars()) already rejects $arg0 via its argument-number check, but meta-argument expansion runs before per-argument parsing and substitutes the value first, bypassing that check. Reject $arg0 explicitly during expansion. Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/ Fixes: 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args") Cc: stable@vger.kernel.org Signed-off-by: Raushan Patel Signed-off-by: Masami Hiramatsu (Google)

tracing/probes: Simplify BTF_KIND_PTR case in fetch_type_from_btf_type()

2026-07-21T08:59:58Z

Use a ternary operator for checking IS_ENABLED(CONFIG_64BIT) in the BTF_KIND_PTR case of fetch_type_from_btf_type() to simplify the code. Link: https://lore.kernel.org/all/178454426554.296567.17700307233923830044.stgit@devnote2/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google)

tracing/probes: Cleanup pointer arithmetic in store_trace_entry_data()

2026-07-21T08:59:54Z

In store_trace_entry_data(), edata is cast to unsigned long for pointer offset arithmetic before being cast back to unsigned long *. Cast edata to u8 * instead. Link: https://lore.kernel.org/all/178454425622.296567.16952341966130280432.stgit@devnote2/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google)

tracing/probes: Remove unused parameter from parse_probe_var_retval()

2026-07-21T08:59:50Z

The parameter 'arg' in parse_probe_var_retval() is unused. Remove it and update its caller accordingly. Link: https://lore.kernel.org/all/178454424711.296567.15352344258939682112.stgit@devnote2/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google)

tracing/probes: Remove redundant bounds check in trace_probe_compare_arg_type()

2026-07-21T08:59:46Z

In trace_probe_compare_arg_type(), prior to entering the comparison loop, a->nr_args and b->nr_args are checked for equality. Since the loop condition is i < a->nr_args, i is guaranteed to be less than b->nr_args inside the loop. Remove the redundant (b->nr_args <= i) check. Link: https://lore.kernel.org/all/178454423769.296567.6694636865644203423.stgit@devnote2/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google)

tracing/probes: Fix potential underflow in LEN_OR_ZERO macro

2026-07-21T01:23:17Z

In __set_print_fmt(), LEN_OR_ZERO is defined as (len ? len - pos : 0). If len is non-zero but smaller than pos, len - pos evaluates to a negative integer. When passed as a size argument to snprintf(), this negative value is cast to a large unsigned size_t, bypassing buffer size limits. Ensure len > pos before subtracting to avoid integer underflow. Link: https://lore.kernel.org/all/178454234934.290363.15247317871499514139.stgit@devnote2/ Fixes: 5bf652aaf46c ("tracing/probes: Integrate duplicate set_print_fmt()") Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google)

tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()

2026-07-21T01:23:13Z

If trace_probe_log.argc is 0 in __trace_probe_log_err(), the loop constructing the command string will not execute and p will remain equal to command. Writing to *(p - 1) will cause an out-of-bounds access before command. This should not happen, but better to be treated. Reject if trace_probe_log.argc is 0. Link: https://lore.kernel.org/all/178454233992.290363.18323091580600697731.stgit@devnote2/ Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events") Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google)

tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()

2026-07-21T01:23:10Z

In trace_probe_match_command_args(), a stack buffer buf[MAX_ARGSTR_LEN + 1] (256 bytes) is used to format "=". However, since name can be up to 32 bytes (MAX_ARG_NAME_LEN) and comm up to 255 bytes (MAX_ARGSTR_LEN), the formatted string can exceed 256 bytes and get truncated by snprintf(), causing spurious argument matching failures. Instead of formatting into a temporary buffer on stack, compare the argument name, the '=' delimiter, and the comm expression directly. Link: https://lore.kernel.org/all/178454233010.290363.10428767141343428804.stgit@devnote2/ Fixes: eb5bf81330a7 ("tracing/kprobe: Add per-probe delete from event") Cc: stable@vger.kernel.org Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google)

tracing/probes: Eliminate recursion in parse_probe_arg()

2026-07-14T13:43:40Z

To avoid potential stack overflows on limited kernel stacks, convert parse_probe_arg() from a recursive function into a loop-based implementation with a simple local state stack. Since recursion is eliminated using a loop with a fixed-size stack in the context, this restricts the dereference nesting depth. The maximum nesting depth of dereferences is now restricted to the same limit as typecasts (TRACEPROBE_MAX_NESTED_LEVEL, which is 8) and reports the same TOO_MANY_NESTED error. Update ftrace selftests to reflect this restriction and simplify the checks. Note that this change slightly alters the behavior of nested dereferencing in fetcharg. Previously, dereferencing without BTF allowed for up to 14 levels of nesting, whereas dereferencing with BTF was limited to 3 levels. With this change, the nesting depth is now limited to 8 levels in both cases. Link: https://lore.kernel.org/all/178399141396.27810.5390060618628718661.stgit@devnote2/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google)